CVE-2012-2138
First published: Mon Jul 09 2012(Updated: )
The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.apache.sling:org.apache.sling.servlets.post | <2.1.2 | 2.1.2 |
| Apache Org.apache.sling.servlets.post | <=2.1.0 | |
| Apache Sling |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2012-2138
- https://issues.apache.org/jira/browse/SLING-2517
- http://mail-archives.apache.org/mod_mbox/www-announce/201207.mbox/%3CCAEWfVJ=PwoQmwJg0KmbrC17Gw51kgfKRsqgy=4RpMQsdGh0bVg@mail.gmail.com%3E
- http://svn.apache.org/viewvc?view=revision&revision=1352865
- https://github.com/apache/sling-org-apache-sling-servlets-post/commit/0205892908d6ea755645be5fc16e9df53e2e7261
- https://github.com/advisories/GHSA-342c-f869-5m44 (Advisory)
- http://mail-archives.apache.org/mod_mbox/www-announce/201207.mbox/%3CCAEWfVJ=PwoQmwJg0KmbrC17Gw51kgfKRsqgy=4RpMQsdGh0bVg%40mail.gmail.com%3E
Frequently Asked Questions
What is the severity of CVE-2012-2138?
CVE-2012-2138 has a severity level that may lead to denial of service through an infinite loop.
How do I fix CVE-2012-2138?
To mitigate CVE-2012-2138, upgrade the org.apache.sling.servlets.post package to version 2.1.2 or later.
What does CVE-2012-2138 affect?
CVE-2012-2138 affects versions of the org.apache.sling.servlets.post bundle prior to 2.1.2.
Who can exploit CVE-2012-2138?
Remote attackers can exploit CVE-2012-2138 by sending crafted HTTP requests.
What type of attack does CVE-2012-2138 facilitate?
CVE-2012-2138 facilitates denial of service attacks by causing an infinite loop.
- collector/github-advisory-latest
- alias/GHSA-342c-f869-5m44
- alias/CVE-2012-2138
- collector/github-advisory
- collector/nvd-cve
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/severity
- agent/last-modified-date
- agent/description
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/maven
- vendor/apache
- canonical/apache org.apache.sling.servlets.post
- version/apache org.apache.sling.servlets.post/2.1.0
- canonical/apache sling